diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 29a2545..5195019 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -713,7 +713,8 @@
 	for (i = 0; i < n; ++i)
 		{
 		name = (unsigned char *)sk_OPENSSL_STRING_value(id->hosts, i);
-		if (X509_check_host(x, name, strlen((const char*) name), id->hostflags) > 0)
+		if (X509_check_host(x, name, strlen((const char*) name), id->hostflags,
+				    &id->peername) > 0)
 			return 1;
 		}
 	return n == 0;
diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c
index a85a2a6..76ee8ae 100644
--- a/crypto/x509v3/v3_utl.c
+++ b/crypto/x509v3/v3_utl.c
@@ -851,8 +851,11 @@
 
 static int do_check_string(ASN1_STRING *a, int cmp_type, equal_fn equal,
 				unsigned int flags,
-				const unsigned char *b, size_t blen)
+				const unsigned char *b, size_t blen,
+				char **peername)
 	{
+	int rv = 0;
+
 	if (!a->data || !a->length)
 		return 0;
 	if (cmp_type > 0)
@@ -860,27 +863,30 @@
 		if (cmp_type != a->type)
 			return 0;
 		if (cmp_type == V_ASN1_IA5STRING)
-			return equal(a->data, a->length, b, blen, flags);
-		if (a->length == (int)blen && !memcmp(a->data, b, blen))
-			return 1;
-		else
-			return 0;
+			rv = equal(a->data, a->length, b, blen, flags);
+		else if (a->length == (int)blen && !memcmp(a->data, b, blen))
+			rv = 1;
+		if (rv > 0 && peername)
+			*peername = BUF_strndup((char *)a->data, a->length);
 		}
 	else
 		{
-		int astrlen, rv;
+		int astrlen;
 		unsigned char *astr;
 		astrlen = ASN1_STRING_to_UTF8(&astr, a);
 		if (astrlen < 0)
 			return -1;
 		rv = equal(astr, astrlen, b, blen, flags);
 		OPENSSL_free(astr);
-		return rv;
+		if (rv > 0 && peername)
+			*peername = BUF_strndup((char *)astr, astrlen);
 		}
+	return rv;
 	}
 
 static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen,
-					unsigned int flags, int check_type)
+					unsigned int flags, int check_type,
+					char **peername)
 	{
 	GENERAL_NAMES *gens = NULL;
 	X509_NAME *name = NULL;
@@ -889,6 +895,7 @@
 	int cnid;
 	int alt_type;
 	int san_present = 0;
+	int rv = 0;
 	equal_fn equal;
 
 	/* See below, this flag is internal-only */
@@ -924,7 +931,6 @@
 	gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
 	if (gens)
 		{
-		int rv = 0;
 		for (i = 0; i < sk_GENERAL_NAME_num(gens); i++)
 			{
 			GENERAL_NAME *gen;
@@ -939,16 +945,14 @@
 				cstr = gen->d.dNSName;
 			else
 				cstr = gen->d.iPAddress;
-			if (do_check_string(cstr, alt_type, equal, flags,
-					    chk, chklen))
-				{
-				rv = 1;
+			/* Positive on success, negative on error! */
+			if ((rv = do_check_string(cstr, alt_type, equal, flags,
+						  chk, chklen, peername)) != 0)
 				break;
-				}
 			}
 		GENERAL_NAMES_free(gens);
-		if (rv)
-			return 1;
+		if (rv != 0)
+			return rv;
 		if (!cnid
 		    || (san_present
 		        && !(flags & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT)))
@@ -962,20 +966,22 @@
 		ASN1_STRING *str;
 		ne = X509_NAME_get_entry(name, j);
 		str = X509_NAME_ENTRY_get_data(ne);
-		if (do_check_string(str, -1, equal, flags, chk, chklen))
-			return 1;
+		/* Positive on success, negative on error! */
+		if ((rv = do_check_string(str, -1, equal, flags,
+					  chk, chklen, peername)) != 0)
+			return rv;
 		}
 	return 0;
 	}
 
 int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,
-					unsigned int flags)
+					unsigned int flags, char **peername)
 	{
 	if (chk == NULL)
 		return -2;
 	if (memchr(chk, '\0', chklen))
 		return -2;
-	return do_x509_check(x, chk, chklen, flags, GEN_DNS);
+	return do_x509_check(x, chk, chklen, flags, GEN_DNS, peername);
 	}
 
 int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,
@@ -985,7 +991,7 @@
 		return -2;
 	if (memchr(chk, '\0', chklen))
 		return -2;
-	return do_x509_check(x, chk, chklen, flags, GEN_EMAIL);
+	return do_x509_check(x, chk, chklen, flags, GEN_EMAIL, NULL);
 	}
 
 int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
@@ -993,7 +999,7 @@
 	{
 	if (chk == NULL)
 		return -2;
-	return do_x509_check(x, chk, chklen, flags, GEN_IPADD);
+	return do_x509_check(x, chk, chklen, flags, GEN_IPADD, NULL);
 	}
 
 int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags)
@@ -1005,7 +1011,7 @@
 	iplen = a2i_ipadd(ipout, ipasc);
 	if (iplen == 0)
 		return -2;
-	return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD);
+	return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD, NULL);
 	}
 
 /* Convert IP addresses both IPv4 and IPv6 into an 
diff --git a/crypto/x509v3/v3nametest.c b/crypto/x509v3/v3nametest.c
index b2e9c09..b38df97 100644
--- a/crypto/x509v3/v3nametest.c
+++ b/crypto/x509v3/v3nametest.c
@@ -333,7 +333,7 @@
 		memcpy(name, *pname, namelen);
 
 		ret = X509_check_host(crt, (const unsigned char *)name,
-				      namelen, 0);
+				      namelen, 0, NULL);
 		match = -1;
 		if (ret < 0)
 			{
@@ -352,7 +352,8 @@
 		check_message(fn, "host", nameincert, match, *pname);
 
 		ret = X509_check_host(crt, (const unsigned char *)name,
-				      namelen, X509_CHECK_FLAG_NO_WILDCARDS);
+				      namelen, X509_CHECK_FLAG_NO_WILDCARDS,
+				      NULL);
 		match = -1;
 		if (ret < 0)
 			{
diff --git a/include/openssl/x509v3.h b/include/openssl/x509v3.h
index a2441fa..dcf105a 100644
--- a/include/openssl/x509v3.h
+++ b/include/openssl/x509v3.h
@@ -714,7 +714,7 @@
 #define _X509_CHECK_FLAG_DOT_SUBDOMAINS 0x8000
 
 OPENSSL_EXPORT int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,
-					unsigned int flags);
+					unsigned int flags, char **peername);
 OPENSSL_EXPORT int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,
 					unsigned int flags);
 OPENSSL_EXPORT int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,